[OisinKyne]

charon deposit sign hex-decoded --withdrawal-addresses straight into DepositMessage.WithdrawalCredentials. A 20 byte address, as the alter withdrawal address docs show, was silently zero-padded by SSZ hashing, so operators signed, and the Obol API stored, deposits with malformed credentials (<address><12 zero bytes>).

• Adds deposit.WithdrawalCredsFromAddrOrCreds: a 20 byte address becomes 0x01 credentials (0x02 for compounding clusters). Mixed case addresses must match their EIP-55 checksum; all lower or all upper case is accepted. Full 32 byte credentials are still accepted if the prefix matches the cluster's compounding setting and bytes 1-11 are zero. Anything else is rejected.
• deposit sign uses it and rejects the zero address on mainnet/gnosis, as create dkg does.
• deposit fetch rejects API credentials that are not 32 bytes, covering bad records already stored.
• obolapimock rejects non 32 byte credentials, mirroring the API fix.
• Tests now use real addresses (the 32 byte input in the old test hid the bug) and the sign/fetch test checks the credentials written to the deposit data file.

Companion changes: obol-api oisin/validate-withdrawal-creds, obol-sdk oisin/validate-withdrawal-creds-length, obol-docs oisin/deposit-sign-v1.11-credentials and oisin/deposit-sign-withdrawal-addresses.

category: bug
ticket: none

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 87.17949% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.64%. Comparing base (4e4d996) to head (60c1892).

Files with missing lines	Patch %	Lines
cmd/depositsign.go	66.66%	3 Missing ⚠️
eth2util/deposit/deposit.go	92.59%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4804      +/-   ##
==========================================
+ Coverage   67.61%   67.64%   +0.02%     
==========================================
  Files         254      254              
  Lines       33609    33641      +32     
==========================================
+ Hits        22725    22756      +31     
- Misses      10883    10884       +1     
  Partials        1        1              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.